chillyCMS 1.3.0 Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1045604 漏洞类型
发布时间 2013-02-15 更新时间 2013-02-15
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013020109
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
# Vulnerability
    Failure to Restrict URL Access
    chillyCMS uses 302 redirects to restrict access to the unautorized pages.
      
# Exploit
    Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/
    Step 2: Access http://localhost/chillyCMS/admin/
  
# Vulnerability
    Arbitrary File Upload
    chillyCMS/admin/design.site.php page extracts all uploaded ZIP files to chillyCMS/tmp directory
      
# Exploit
    Step 1: Create a ZIP file of the files to be uploaded. Example: Compress shell.php to get shell.zip
    Step 2: Upload shell.zip
    Step 3: Access the shell at http://localhost/chillyCMS/tmp/shell.php
      
# History
    11 March 2012 - Discovered vulnerability and exploit, contacted the vendor.
    12 March 2012 - Vendor responds back, exchanges few mails.
    15 November 2012 - Vendor discontinues further development.
    15 February 2013 - Published the vulnerabilities and exploits to the public.
      
# How to reproduce
    The latest download from the website was not working on fresh install. An earlier version (1.1.3) has been installed and all the PHP files, except config.php, have been replaced with new files.